CVE-2026-87432

Google Chrome versions prior to 153.0.8010.36 are vulnerable to an incorrect authorization flaw in Navigation . A remote attacker who has already compromised the renderer process can exploit this to spoof UI elements using a crafted HTML page. This vulnerability affects Chromium -based browsers, ...

CVE-2026-87479

A vulnerability exists in Google Chrome (prior to version 153.0.8010.36 ) due to insufficient policy enforcement in Extensions . A remote attacker who has compromised the renderer process and used social engineering can execute arbitrary code outside the sandbox via a crafted HTML page. Remediati...

CVE-2026-87521

An information leak in WebMCP within Google Chrome prior to version 153.0.8010.36 allows a remote attacker who has compromised the renderer process to obtain cross-origin data via a crafted HTML page. This vulnerability has a Chromium security severity of Medium . Microsoft Edge is also affected ...

CVE-2026-87576

Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87580

Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87580

Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87580

Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74339

Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87576

A vulnerability in Google Chrome on Android (prior to version 153.0.8010.36) allows a remote attacker to read memory outside the sandbox. The root cause is an uninitialized resource in the GPU , which can be triggered via a crafted HTML page by an attacker who has already compromised the renderer...

CVE-2026-87580

Google Chrome versions prior to 153.0.8010.36 are vulnerable to an incorrect authorization flaw in WebAppInstalls . A remote attacker who has already compromised the renderer process can leverage social engineering to bypass site isolation using a crafted HTML page. This vulnerability is reported...

CVE-2026-87582

Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87582

Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87652

Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87652

Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87652

Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74326

Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87582

Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74327

Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87652

Google Chrome versions prior to 153.0.8010.36 are vulnerable to an incorrect authorization flaw in the PushAPI . A remote attacker who has already compromised the renderer process can exploit this by using a crafted HTML page to bypass the web origin policy . This vulnerability affects Chromium-b...

CVE-2026-87582

Google Chrome versions prior to 153.0.8010.36 are vulnerable to a confused deputy vulnerability in the DataTransfer component. This flaw allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox by leveraging a crafted HTML...